note 89945 added to pdo.prepare

@Anonymous I disagree that it's bad design to have table names coming from an unsafe source. For example, if you're designing a CMS and give users the power to make their own plugins quite frequently they will do something silly like take a table name from a request. In this instance it should be the database framework that escapes the table name and I think it would be good if there was a better way of doing it than $pdo->prepare("SELECT * FROM ".addslashes($schema)."")->execute(); something like $pdo->prepare("SELECT * FROM ".$pdo->escape($schema)."")->execute(); would be nice. ---- Server IP: 217.13.201.10 Probable Submitter: 78.86.183.235 ---- Manual Page -- http://www.php.net/manual/en/pdo.prepare.php Edit -- https://master.php.net/note/edit/89945 Del: integrated -- https://master.php.net/note/delete/89945/integrated Del: useless -- https://master.php.net/note/delete/89945/useless Del: bad code -- https://master.php.net/note/delete/89945/bad+code Del: spam -- https://master.php.net/note/delete/89945/spam Del: non-english -- https://master.php.net/note/delete/89945/non-english Del: in docs -- https://master.php.net/note/delete/89945/in+docs Del: other reasons-- https://master.php.net/note/delete/89945 Reject -- https://master.php.net/note/reject/89945 Search -- https://master.php.net/manage/user-notes.php